Executive brief
HelloTalk, a popular language-learning application, was found to inadvertently share the precise GPS locations of its users with others. Even when a user chose to only share their city or country, the app transmitted their exact coordinates to any person who viewed their profile. This data was then stored in a local database on the viewer's device, potentially allowing someone to track a user's home address or exact movements.
Technical details
The vulnerability stems from server-side over-disclosure (CWE-359) where the API transmits full-precision GPS coordinates (up to six decimal places) to any client viewing a profile, regardless of the user's privacy settings. In affected versions (through 3.4.1), the Android client then cached this sensitive data into an unencrypted SQLite database located in the 'htbackup/' directory on the viewer's device. An attacker could view a target's profile and then extract their exact latitude and longitude from their own device's local storage. While the vendor implemented database encryption in late 2019 to mitigate local extraction, the underlying issue of the server transmitting precise coordinates to the client remained a concern at the time of discovery.
Affected products
- HelloTalk HelloTalk up to and including 3.4.1
Timeline
- 2019-04-16: disclosed: Vulnerability reported to vendor
- 2019-08-01: patched: Vendor encrypted the local database to prevent easy extraction
- 2026-06-05: advisory: Public disclosure and CVE publication